Likhtam ("the app") is developed and operated by TechShah("we", "us"), a company based in Delhi, India. Likhtam is an accounting, GST billing, inventory and loan-tracking application. This policy explains what data the app collects, how it's stored, when it leaves your device, and the choices you have. It applies to the Likhtam mobile and web apps and this website, and is written to meet the obligations of India's Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 (together, "DPDP"), as well as general data-protection expectations for users of Likhtam outside India.

Data we collect

To run your books, Likhtam works with:

• Business data: invoices, purchases, inventory items, parties (customers/suppliers), expenses, loans, journal entries, staff and payroll records, and the reports generated from them. Tax IDs (GSTIN, TRN, PAN) and bank details are stored encrypted.
• Account & contact data: your name, email address, phone number, and business details (name, address, city, state, GSTIN/VAT registration) provided during setup.
• Party data: names, phone numbers, email addresses, and addresses of the customers and suppliers you add to your own books. For all customer, supplier, and staff data entered in your books, your business is the data controller (fiduciary) and Likhtam acts as the data processor.
• Device permissions:
  • Contacts: accessed on a read-only basis, only for the single contact you actively select to import — Likhtam never accesses or copies your full address book.
  • Camera: used only when you take a photo of a bill/receipt for Document Scan or scan an item barcode; no background captures.
  • Biometric & PIN unlock: fingerprint, face unlock, and app PIN stay entirely on your device via native device hardware and are never transmitted to or stored on our servers.
• Activity log: records which team member created, edited, or deleted invoices, expenses, vouchers, and journal entries, as well as account sign-in timestamps. This log is visible to the company owner.
• Public catalog & customer orders: if you choose to enable the public digital catalog, anyone with the link can view your catalog; customers ordering through it share their name, phone number, and delivery address with your business.
• Payment data: when you purchase a subscription, Android payments are handled by Google Play Billing and web payments in India are handled by Razorpay — neither gives us your card, bank, or UPI details.

We do not collect data we don't need to run the app. There is no advertising SDK in Likhtam, and we do not sell business or personal data.

Consent

When you create a Likhtam account, you're asked to actively tick a checkbox confirming you agree to these terms and this privacy policy, and consent to your personal data (name, email, phone) being processed to create and operate your account — account creation is blocked until you do. You can withdraw consent at any time by deleting your account (Profile > Danger Zone > Delete My Account) or company (Company Settings > Danger Zone > Delete Company) directly inside the app, or via https://likhtam.com/delete-account, though withdrawing consent for data already needed to complete an in-progress transaction or legal obligation may not be immediate.

Local-first storage

By default, Likhtam is offline-first: your ledgers, invoices, inventory and reports are stored locally on your device. On the Free plan, your data stays on that device unless you back it up or export it yourself. Your account details (name, email, phone) and activity log are always stored on our servers so you can sign in.

Cloud sync (Trial & Pro)

Trial and Pro plans can turn on real-time cloud sync so the same books are available across your devices. When enabled, your business data is stored on our backend infrastructure (via Supabase) in an encrypted database, accessible only to your account and any team members you explicitly invite. Turning cloud sync off stops new data from syncing; previously synced data can be deleted on request.

Payments

Android subscriptions go through Google Play Billing under Google's standard terms. Web subscription payments in India go through Razorpay under its PCI-DSS compliant systems. Neither Google Play Billing nor Razorpay gives us your card, bank, or UPI details. Likhtam only receives confirmation that a payment succeeded, along with a transaction reference for plan activation and receipt generation.

Cookies & website analytics

This marketing website does not use advertising cookies, tracking pixels, or third-party analytics scripts. If that changes in the future — for example, to add privacy-respecting analytics — this section will be updated first to say what's added and why.

Sharing

We share data only where it's needed to run the service (as sub-processors):

• Supabase: our primary cloud database provider, for cloud sync, user authentication, and encrypted backups.
• Google Gemini API: bill images or PDFs you choose to scan with Document Scan are sent to Google to read them. Google processes these files only to return the scan result and, under Google's paid API terms, does not use them to train its models.
• Cloudflare R2: for secure storage and delivery of uploaded company logos and product catalog images.
• Google Sign-In: to verify your identity if you choose Google authentication.
• GST lookup services (gstinapi.in, gstverify.co.in): receive only the specific GSTIN entered to fetch registered taxpayer details.
• Our e-invoice / e-way bill provider: receives invoice and transport details only when the user explicitly chooses to file. E-invoice portal logins are stored encrypted (Supabase Vault).
• Google Play Billing & Razorpay: for processing mobile and web subscriptions; neither gives us card/UPI details.
• Team members: collaborators you invite to a multi-user workspace, restricted to the permission level you assign.
• Legal compliance: when strictly required by law, such as a valid legal request from a tax or regulatory authority.

We do not share your business data with advertisers or data brokers.

International data storage

Our primary database is in India (Mumbai). For users outside India, your data is transferred to and processed in India. When your data is transferred to India, we protect it with the same safeguards described in this policy.

Retention & deletion

Locally stored data stays on your device until you delete the app, reset app storage, or delete your company/account. Cloud-synced data is retained while your account is active. Users can delete their account (Profile > Danger Zone > Delete My Account) or company (Company Settings > Danger Zone > Delete Company) directly inside the app, or via https://likhtam.com/delete-account or by writing to support@likhtam.com.

Statutory tax retention notice: Please be aware that tax law may require businesses to keep invoices, ledgers, vouchers, and books for prescribed statutory periods (India 6–8 years under GST, Income Tax and the Companies Act; Gulf region 5–7 years; UK, Australia, and Singapore 5 years). We strongly recommend you export all reports and accounting statements before deleting your company or account.

Security

All cloud-synced data is encrypted in transit using industry-standard Transport Layer Security (TLS) and stored on secure cloud database infrastructure. Day-to-day transaction records, invoices, and books remain stored locally on your device for offline use. Access to production systems is strictly restricted to authorized personnel. While no electronic transmission or storage method is 100% secure, we implement technical and organizational security measures to safeguard your financial records and personal information.

Your rights

As a Data Principal under DPDP (or under the equivalent law where you're registered), you have the right to:

• Access a summary of the personal data we hold about you.
• Correct inaccurate or outdated personal data.
• Erase your personal data once it's no longer needed for the purpose it was collected for, or to withdraw consent — you can delete your account (Profile > Danger Zone > Delete My Account) or company (Company Settings > Danger Zone > Delete Company) directly inside the app or see https://likhtam.com/delete-account.
• Grievance redressal — raise a complaint about how your data is handled and get a response (see Contact below).
• Nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.

To exercise any of these rights, contact us at support@likhtam.com. If you're not satisfied with our response, you may escalate a DPDP complaint to India's Data Protection Board.

Third-party links

Our website and app may link out to third-party sites (like the Play Store, or Razorpay's checkout page). We're not responsible for the privacy practices of those sites — check their own policies before sharing information with them.

Children's data

Likhtam is a business tool and is not directed at children. We do not knowingly collect data from anyone under 18.

Changes to this policy

If this policy changes materially, we'll update the "Last updated" date above and, for significant changes, notify account holders by email.

Contact & grievance officer

Questions about this policy or your data: support@likhtam.com or +91 88260 90432. TechShah is based in Delhi, India.

In accordance with the Digital Personal Data Protection Act, 2023, the Digital Personal Data Protection Rules, 2025, the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and rules made thereunder, the Grievance Officer for privacy-related complaints can be reached at the same address. We aim to acknowledge privacy complaints within 48 hours and resolve them within 30 days.

If we become aware of a personal data breach affecting your account, we'll notify you and the Data Protection Board without undue delay, describing what happened, what data was involved, and what you can do — consistent with DPDP's breach-notification requirements.